Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.0

A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker with privileged EXEC credentials to cause...

CVE-2020-3201 · published 6 years ago
Summary

A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker with privileged EXEC credentials to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient in...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
cisco ios 12.2\(18\)ixa
12.2\(18\)ixb
12.2\(18\)ixb1
12.2\(18\)ixb2
12.2\(18\)ixc
12.2\(18\)ixd
12.2\(18\)ixd1
12.2\(18\)ixe
12.2\(18\)ixf
12.2\(18\)ixf1
12.2\(18\)ixg
12.2\(18\)ixh
1658 more version ranges
cpe:2.3:o:cisco:ios:12.2\(18\)ixa:*:*:*:*:*:*:*
cisco ios_xe 3.2.0sg
3.2.1sg
3.2.2sg
3.2.3sg
3.2.4sg
3.2.5sg
3.2.6sg
3.2.7sg
3.2.8sg
3.2.9sg
3.2.10sg
3.2.11sg
235 more version ranges
cpe:2.3:o:cisco:ios_xe:3.2.0sg:*:*:*:*:*:*:*
Original advisory text
A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker with privileged EXEC credentials to cause...
A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker with privileged EXEC credentials to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient input validation of data passed to the Tcl interpreter. An attacker could exploit this vulnerability by executing crafted Tcl arguments on an affected device. An exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.0 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published3 Jun 2020
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2020-3201 · NVD
Track software like this
Free during beta